17 



What is claimed is: 

1. A method for monitoring an incoming data stream for specified events, 
comprising: 

receiving at least one data stream at a computer, the data stream including data 
representative of events; and 

applying rules to the data stream for sorting data representative of events and for 
taking an action based on a specified event. 

2. The method of claim 1, comprising displaying events associated with a 
selected data stream on a time line. 

3. The method of claim 1, comprising gathering data at a remote location and 
placing the gathered data in a data stream and forwarding the data stream to the 
computer. 

4. The method of claim 3, wherein said gathering step is performed by an 

agent. 

5. The method of claim 1, comprising hunting for predetermined data at a 
remote location and placing the hunted data in a data stream and forwarding the data 
stream to the computer. 

6. The method of claim 5, wherein said hunting step is performed by an 

agent. 

, 7. The method of claim 5, comprising normalizing the data before the data is 
placed in the data stream. 
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8. The method of claim 1, wherein the at least one data stream includes 
message traffic. 

9. The method of claim 5, comprising linking the hunted data with a location 
where the hunted data was located. 

10. The method of claim 9, comprising updating the received hunted data with 
new hunted data as new data is received at the hunted data location. 

11. The method of claim 6, comprising constructing an event stream object 
which is forwarded to the computer by the agent. 

12. The method of claim 11, wherein the event stream object includes 
information descriptive of an event. 

13. The method of claim 12, wherein the information includes at least one of 
the following: the time that the event occurred; the duration that event covered; and key 
words that describe the event. 

14. The method of claim 1, comprising filing the sorted information in 
separate data stream files. 

15. The method of claim 1, wherein an event is comprised of at least one of 
the following elements: type, title, datetime, keywords, summary, priority and duration. 

16. The method of claim 1, wherein a rule includes a criteria component and 
an action component. 

17. The method of claim 16, wherein the criteria component includes at least 
one criteria statement and to satisfy a rule either all, any or none of the at least one 
criteria statements need to be satisfied. 
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18. The method of claim 17, wherein at least one action is taken if the at least 
one rule is satisfied. 

19. The method of claim 1, wherein the data in the event data stream is 
received in a standardized format. 

20. The method of claim 14, comprising displaying an event stream using 
information stored in stored data stream files. 

21. The method of claim 20, comprising displaying an event stream using a 
received sorted data stream. 

22. An article comprising: 

at least one sequence of machine executable instructions; 

a medium bearing the executable instructions in machine readable form, wherein 
execution of the instructions by one or more processors causes the one or more 
processors to: 

receive at least one data stream at a computer, the data stream including data 
representative of events; and 

apply rules to the data stream for sorting data representative of events and for 
taking an action based on a specified event. 

23. The article of claim 22, comprising causing the processor to display events 
associated with a selected data stream on a time line. 

24. A computer architecture for monitoring an incoming data stream for 
specified events, comprising: 

receiving means for receiving at least one data stream at a computer, the data 
stream including data representative of events; and 
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applying means for applying rules to the data stream for sorting data 
representative of events and for taking an action based on a specified event. 

25. The computer architecture of claim 24, comprising displaying means for 
displaying events associated with a selected data stream on a time line. 

26. A computer system, comprising: 
a processor; and 

a memory coupled to said processor, the memory having stored therein sequences 
of instructions, which, when executed by said processor, causes said processor to perform 
the steps of: 

receiving at least one data stream at a computer, the data stream including data 
representative of events; and 

applying rules to the data stream for sorting data representative of events and for 
taking an action based on a specified event. 

27. The computer system of claim 26, comprising causing the processor to 
display events associated with a selected data stream on a time line. 



